Binance Hack, October 2026: What Happened and What It Did to Crypto Futures

Short answer: on the evening of October 29, 2026, attackers drained Binance hot wallets on ten blockchains, most of it in about half an hour. Binance estimates the total impact at about $6.3 billion, which makes it the largest crypto theft on record. Binance says user funds are safe and that the loss will be covered from its SAFU fund and company money (Binance). Withdrawals are paused; Binance expects to resume them within 48 hours of its update at 04:36 UTC on October 30. Stablecoin issuers and other parties froze about $2.7–3 billion of the stolen assets within hours.

We also checked what the hack did to the futures market, minute by minute, on Binance, Bybit and OKX. Bitcoin fell 4.9% at the low, partly together with US tech stocks, which fell the same evening. Prices on Binance never broke away from other exchanges: the median gap on BTC during the theft was 0.6 basis points (0.006%). Traders kept treating Binance as solvent.

This article was written on October 30, 2026. Figures in a hack this fresh change quickly, so each one below says who reported it. We will update the page when Binance publishes its full report.

What happened: the timeline

All times are UTC. The onchain steps come from TRM Labs, which traced the theft across ten chains (TRM Labs).

Binance's statements come from its posts on X and its announcement page (Binance). Co-CEO Yi He first said the exchange was investigating reports of a potential security issue, and shortly after midnight wrote that Binance "will cover all hacking losses" (The Block). Binance.US said it is a separate platform and was not affected.

How much was stolen from Binance?

The estimates differ because people measured at different moments and counted different things: what left the wallets, what was frozen, and at which prices.

Arkham counted $6.01 billion leaving hot wallets on nine chains between 20:10 and 23:05 UTC. By chain, TRM counts about $3.79 billion on Ethereum (200,630 ETH, 1.875 billion USDT, 823 million USDC and other tokens), $1.47 billion on Bitcoin (18,270 BTC), $628 million on Tron, $296 million on the XRP Ledger, $96 million on Solana and smaller amounts on Arbitrum, Optimism, Base, Avalanche and Polygon.

Any of these numbers is a record. The previous largest theft was the Bybit hack of February 2025 at about $1.5 billion, and the largest older case, the LuBian mining pool in 2020, was about $3.5 billion.

How did the hackers get into Binance?

Binance has not published a full report yet. Two accounts exist so far, and they fit together.

Binance's initial investigation: the incident "may involve a compromised DevOps engineer's laptop". Through it, the attacker reached a service container inside Binance's systems and submitted withdrawals that were not authorised. Binance said it found "no evidence of any wallet private key leak" (Binance). In a later update it added that the incident "stems from multiple factors" and that the compromised computer "may be the entry point". A full report with the root cause is still to come.

The onchain picture from TRM Labs:

• The attack was prepared in advance. The attacker's operating wallet was funded through Tornado Cash a day earlier, and the code was tested on three wallets before it touched Binance.
• On Ethereum, the attacker used EIP-7702, a feature added in the Pectra upgrade in May 2025 that lets an ordinary wallet act like a smart contract. One transaction carried 50 pre-signed authorizations for consecutive nonces. The one that matched the wallet's current nonce turned the Binance hot wallet into a "sweeper" controlled by the attacker, and it emptied the wallet about three and a half minutes later.
• On the other nine chains, Binance wallets sent funds through ordinary signed transfers within about 30 minutes.
• TRM's view is that the most likely explanation is a compromise of Binance's hot wallet signing system, because phishing alone does not explain signed transfers on ten chains at once.

If Binance's account holds, the attackers did not need the keys: they got far enough inside Binance to make its own systems sign the withdrawals. One question is still open: how the withdrawal service came to sign 50 EIP-7702 authorizations. Binance has not explained it yet.

Who is behind the Binance hack?

No one has confirmed it officially. TRM Labs attributes the attack to TraderTraitor, a North Korean hacking unit, "with high confidence", based on onchain and off-chain intelligence. The FBI attributed the Bybit hack of February 2025 to the same group. Chainalysis also links the theft to North Korea. Blockaid said the tactics were consistent with North Korean operations, and the investigator ZachXBT named the Lazarus Group as the likely attacker. Binance has not named a culprit and says it is working with law enforcement to identify those responsible.

How much of the stolen money has been frozen?

A large part, and fast, because much of the theft was in stablecoins whose issuers can freeze tokens.

Source: TRM Labs, snapshot at 00:30 UTC on October 30. TRM's total is about $2.7 billion. Binance reported a verified frozen total of $2.54 billion at 23:35 UTC and about $3 billion frozen onchain in its 02:23 UTC update (Binance).

How the attacker tried to get around the freezes

USDT and USDC can be frozen by their issuers; ETH and BTC cannot. In the first hours the attacker tried to turn freezable stablecoins into ETH in three ways, according to TRM Labs and onchain trackers:

• Selling at a loss. About 325 million USDT went to market makers and solvers for about 122,300 ETH, roughly $2,650 per ETH while ETH traded near $2,300–2,350. The attacker paid more than 10% above the market to get out of USDT quickly. The other 175 million USDT from that batch was frozen.
• Borrowing against stolen USDT. On Aave, the attacker supplied 60 million USDT as collateral and borrowed about 19,760 ETH, which Tether cannot freeze. At 22:44 UTC Aave froze all DAO-run markets on V3 and V4: no new deposits or loans, while withdrawals and repayments still work. Aave said its contracts were not affected and positions remained overcollateralized (Aave on X). On Tron, 300 million USDT went into the JustLend lending protocol.
• Selling other tokens. By 01:01 UTC the attacker had sold UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD for 70,480 ETH, about $158 million (Lookonchain).

What remains out of reach, by TRM's count, is about $2.4 billion: more than 420,000 ETH and the 18,270 BTC. TRM expects the next stage to go through bridges, swap services and OTC brokers.

Is my money safe on Binance?

Binance says yes. Its official position is that user funds are safe and that it "will cover all losses from the SAFU fund and the company's funds" (Binance). Founder Changpeng Zhao, who no longer runs Binance.com, said that as a shareholder he expects all user funds to be fully covered.

The numbers behind that promise:

• SAFU is not big enough on its own. The Secure Asset Fund for Users was created in 2018 from 10% of trading fees and has been kept at about $1 billion since 2022. In January–February 2026 Binance converted it into 15,000 BTC and committed to top it up to $1 billion if it falls below $800 million (The Block). At about $77,700 per BTC that is roughly $1.17 billion, under a fifth of the affected amount. The rest has to come from Binance itself.
• The hole is large but not fatal on paper. DefiLlama counted about $144 billion in assets on Binance before the hack, so $6.3 billion is roughly 4% of it. About $3 billion of the stolen assets is already frozen, by Binance's count.
• The last reserve check is from before the hack. Binance publishes monthly proof-of-reserves snapshots. The latest one we could verify, for August 1, 2026, showed 100.25% coverage for BTC and ETH and 103.62% for USDT (Crypto Briefing). Binance has said it will publish an updated report after the fix. A proof-of-reserves snapshot is useful, but it is not a full financial audit.

We cannot verify Binance's solvency from the outside. What we can measure is how the market priced it: see our minute-by-minute check of futures prices below.

Can I withdraw from Binance right now?

Not yet. In its update at 04:36 UTC on October 30, Binance said that withdrawals remain paused while it completes "a security revamp of the withdrawal service and its related addresses", and that it expects to resume them within 48 hours (Binance on X). That points to about November 1, but Binance has not given an exact date. The same update says deposits "remain unaffected and continue to operate as normal", although posts from 00:13 to 02:23 UTC said deposits were suspended too.

Check the official announcements in the Binance app for the current status, and do not follow links from emails or messages that promise faster access or compensation.

For context, in Binance's previous hack, in May 2019 (7,000 BTC, about $40 million, fully covered by SAFU), deposits and withdrawals were paused for about eight days (Binance). Bitget, after losing $387.5 million in September 2026, brought all withdrawals back in about eight days. Bybit in February 2025 did not pause withdrawals at all and processed more than 350,000 withdrawal requests in the first ten hours.

What the hack did to crypto futures: our minute-by-minute check

We pulled 1-minute candles for BTC, ETH, BNB, XRP and SOL perpetual futures from the public APIs of Binance, Bybit and OKX, from 14:00 UTC on October 29 to 05:30 UTC on October 30, plus 5-minute open interest from Binance and Bybit. The method is described at the end.

Bitcoin fell about 5%, and the low came six hours later

At 20:04 UTC, the minute before the first outflow, BTCUSDT on Binance closed at $80,367. Within 45 minutes it touched $78,210 (20:47 UTC), bounced to $79,765 by 21:19, and then slid again after 23:30. The low came at 02:06 UTC on October 30: $76,444, or 4.9% below the pre-hack close. By 05:30 UTC the price was back to −2.2%.

At their lows, ETH fell 6.0%, SOL 6.9%, XRP 5.6% and BNB 8.4%. BNB took the hardest hit, as you would expect for the token most closely tied to Binance.

Not all of the drop was the hack. At 20:00 UTC, the New York close, Amazon and Intel shares fell 9.9% and 20.8% in the first four minutes of after-hours trading, and Nasdaq-100 futures lost 1.1% (Yahoo Finance minute data). BTC lost 0.55% in the same minutes, before the first outflow at 20:05. The hack itself shows most clearly in BNB: by 20:47 UTC, five minutes after the first news headline about the outflows, BNB was down 7.9% from its 19:59 price and BTC 2.9%, while Nasdaq futures stayed near −1.2%.

The drop forced out leveraged longs. CoinGlass counted $1.55 billion in liquidations across the crypto market in 24 hours, $1.34 billion of it in long positions, from 246,482 traders. The largest single liquidation, $11.09 million, was on Binance BTCUSDT (The Block).

Prices on Binance did not break away from other exchanges

This is the number that shows how the market judged Binance's solvency. When traders believe an exchange cannot pay, prices on that exchange split from the rest of the market. On November 10, 2022, as FTX froze withdrawals, ETH on FTX traded 4.5% above Binance and SOL 11% above (CoinDesk). Nothing like that happened on October 29.

The gap is the Binance perpetual price minus the average of Bybit and OKX, in basis points (1 bp = 0.01%). On BTC, the median gap during the theft was smaller than in the six calm hours before it. XRP and SOL, two of the stolen coins, traded slightly higher on Binance than elsewhere, by about 2 bp, which is $2 on a $10,000 position.

Volume rose on every exchange: BTC futures turnover on Binance was 2.4 times its usual hourly level, on Bybit 3.1 times. Binance kept about half of all BTC futures turnover across the three venues, 51% before the theft and 49% during it. Traders did not leave Binance's order books.

New positions were opened faster on Bybit than on Binance

Open interest adds detail. Counted in coins, so the price drop does not distort it, BTC open interest from 20:05 to 00:30 UTC rose 7.1% on Bybit and 0.9% on Binance. On ETH it rose 3.4% on Bybit and fell 1.4% on Binance. On SOL and XRP, positions on Binance shrank by 9.6% and 7.1%.

The largest move was in BNB on Bybit: open interest jumped 41.5% while the price fell, and the funding payment at 00:00 UTC was −0.065% for 8 hours, so shorts were paying longs. Traders who wanted to sell Binance's own token short did it on another exchange.

With withdrawals paused, small spot gaps lasted longer

Arbitrage keeps prices aligned by moving coins between exchanges. With withdrawals paused, money sent to Binance could not come back out, so few traders wanted to send coins in, and gaps could only be closed with balances already held on each side. They lasted longer. The BNB gap started to widen around 20:40 UTC, when the outflows were already visible onchain and before Binance's first public post. On BNB/USDT spot, Binance traded 1.3 bp below Bybit on average before the theft and 12 bp above it after 00:30 UTC. On BTC spot the gap went from almost zero to +1.6 bp.

These gaps are small and fit what you would expect when arbitrage slows down during a pause.

The same pattern as the Bybit hack

We ran the same check on the Bybit hack of February 21, 2025. In the six hours after the theft, Bybit's BTC perpetual traded within a median 2.4 bp of Binance and OKX (1.7 bp before), and Bybit kept its usual 24% share of BTC futures turnover across the three venues. BTC fell 4.2% at the low and ETH 7.2%. In both cases the hacked exchange kept trading at market prices, which is what you would expect when the market believes the loss will be covered.

The biggest crypto hacks in history

Sources: TRM Labs, Chainalysis, DefiLlama, the exchanges' own announcements and media reports, collected on October 30, 2026. FTX in November 2022 is not in the table: it was a collapse and a fraud case, not a hack, and its customers were repaid in dollars at November 2022 prices, about $16,871 per bitcoin.

With Binance, 2026 is already the worst year for crypto theft in DefiLlama's database: $8.15 billion across 322 incidents, against $2.72 billion in 2025. Chainalysis counted more than $3.4 billion stolen in 2025, of which at least $2.02 billion went to North Korean groups.

What futures traders can take from this

• A hack can stop your money from moving, while trading goes on. On October 29, Binance futures kept trading with normal prices and higher volume, but nobody could withdraw. A trader hedged across two exchanges could not move margin from Binance to the other side.
• Keep only working margin on any one exchange. Funds you are not using for open positions do not need to sit on an exchange. We covered the same point for exchanges that leave a country in An Exchange Can Leave in Five Days.
• Watch the price gap between exchanges. A gap of a few basis points is noise. A gap of several percent on the same coin, as on FTX in 2022 or Mt. Gox in 2014, means the market doubts that balances on that exchange can be withdrawn. The free Binam screener shows cross-exchange price gaps for Binance, Bybit and OKX on one screen.
• Expect funding to move. After the hack, funding on BNB at Bybit turned to −0.065% for 8 hours and ETH funding went negative on both Binance and Bybit. If you hold a position through a shock, the funding bill can change quickly; see how funding works.
• Use official channels only. Big hacks bring fake "compensation" and "account verification" messages. Read announcements in the exchange app or on its site, opened from your saved address.

Did the hack affect Binam traders?

No. Binam traders were not affected. At Binam, a crypto prop trading firm, evaluations run on demo accounts with real quotes, on Bybit or on Binance through the CScalp terminal, so during a challenge the money at stake is the challenge fee, not a deposit on the exchange. How the Binance option works is described in Binance Prop Firm Challenge: How to Trade It in CScalp.

Frequently asked questions

Was Binance hacked?

Yes. On October 29, 2026, starting at about 20:05 UTC, attackers drained Binance hot wallets on ten blockchains. Binance confirmed a security incident, estimated the total impact at about $6.3 billion and paused withdrawals.

How much was stolen from Binance?

Binance estimates the total impact at about $6.3 billion. TRM Labs counts $6.36 billion at the time of the theft, Chainalysis about $6.4 billion, DefiLlama $5.78 billion and Blockaid $5.5 billion. About $2.7–3 billion was frozen within hours.

Is my money safe on Binance after the hack?

Binance says user funds are safe and that it will cover all losses from its SAFU fund (15,000 BTC, about $1.17 billion) and company funds. The affected amount is about 4% of the assets Binance held before the hack. Through the night, futures prices on Binance stayed in line with other exchanges, which suggests the market expected the loss to be covered. No outside party can fully verify this until Binance publishes its report and an updated proof of reserves.

When will Binance withdrawals resume?

Binance said at 04:36 UTC on October 30 that it expects to resume withdrawals within 48 hours, which points to about November 1. Deposits work as normal, according to the same update. In Binance's 2019 hack, the pause lasted about eight days. Check the official announcements in the Binance app.

Can I still trade futures on Binance?

Yes. Spot and futures trading continued during the incident: our minute data show no gaps in trading, normal prices and higher volume through the night of October 29–30. Withdrawals were paused, and Binance Alpha trading was suspended.

How did the hackers get into Binance?

Binance's initial investigation points to a compromised laptop of a DevOps engineer, which gave the attacker access to a service container that submitted unauthorised withdrawals. Binance found no evidence of a private key leak and says the incident stems from multiple factors. On Ethereum, the attacker used an EIP-7702 delegation to take control of a hot wallet; TRM Labs thinks the hot wallet signing system was compromised.

Who hacked Binance?

TRM Labs attributes the attack to TraderTraitor, a North Korean group, with high confidence, and Chainalysis also points to North Korea. Binance and governments had not confirmed the attribution as of October 30, 2026.

Is this the biggest crypto hack ever?

Yes, by any estimate. The previous record was the Bybit hack of February 2025, about $1.5 billion. The largest earlier case, the LuBian mining pool in 2020, was about $3.5 billion.

What is the Binance SAFU fund?

SAFU (Secure Asset Fund for Users) is an emergency fund Binance created in 2018 from 10% of trading fees. It covered the 2019 hack in full. Since February 2026 it holds 15,000 BTC, and Binance has pledged to top it up to $1 billion if it falls below $800 million.

Did the Binance hack affect Binam?

No. Binam traders were not affected. Binam challenges run on demo accounts with real quotes, so the money at stake is the challenge fee, not a deposit on the exchange.

How we collected the data

Prices: 1-minute candles for USDT-margined perpetual futures (BTC, ETH, BNB, XRP, SOL) from the public APIs of Binance, Bybit and OKX, and BNB and BTC spot from Binance and Bybit, from 14:00 UTC on October 29 to 05:30 UTC on October 30, 2026. The gap is the 1-minute close on Binance divided by the average close on Bybit and OKX, minus one, in basis points. "Before" is 14:00–20:00 UTC, "during" is 20:05 UTC (the first outflow in TRM's timeline) to 00:30 UTC (TRM's snapshot), "after" is 00:30–05:30 UTC. Price drops are measured from the 20:04 UTC close to the lowest 1-minute low. Open interest: 5-minute data in coins from Binance and Bybit. The Bybit 2025 comparison uses the same method around the theft at 14:13 UTC on February 21, 2025.

What this check cannot show: liquidations by exchange, the state of order book depth, and what happened after 05:30 UTC on October 30. Figures about the attack itself come from TRM Labs, Binance's statements and the media sources linked above, as of October 30, 2026.

Trading crypto futures involves risk. This article is for information only and is not investment or legal advice.